General

  • Target

    JaffaCakes118_a925b2cf57c1775250f080d35679ffe54c7ccb796e0ab101c9ced1884cb63e8e

  • Size

    727.2MB

  • Sample

    241229-jwjkhsxjen

  • MD5

    06e542af12fb7554e87bfab5ed60fbfc

  • SHA1

    587ca1cb3975ccf063a101dd6696f817afc4f148

  • SHA256

    a925b2cf57c1775250f080d35679ffe54c7ccb796e0ab101c9ced1884cb63e8e

  • SHA512

    49a0021ba3cc35d3f2566a3399aa2c792d5f3a112c481036531535177bfe1c91baaea3383486934c3137f9f4996a178d7c4e4deaa0ed177a3c84f243a053b1f1

  • SSDEEP

    196608:zPmWNoOhqQiU27OokHplwAvpBenhmBveoeW1PrV8:z0eqXKHpllv7Kglq+Pa

Malware Config

Extracted

Family

raccoon

Botnet

055897d0963acbbc3c7d28d055fa1542

C2

http://45.144.29.243/

Attributes
  • user_agent

    mozzzzzzzzzzz

rc4.plain

Targets

    • Target

      JaffaCakes118_a925b2cf57c1775250f080d35679ffe54c7ccb796e0ab101c9ced1884cb63e8e

    • Size

      727.2MB

    • MD5

      06e542af12fb7554e87bfab5ed60fbfc

    • SHA1

      587ca1cb3975ccf063a101dd6696f817afc4f148

    • SHA256

      a925b2cf57c1775250f080d35679ffe54c7ccb796e0ab101c9ced1884cb63e8e

    • SHA512

      49a0021ba3cc35d3f2566a3399aa2c792d5f3a112c481036531535177bfe1c91baaea3383486934c3137f9f4996a178d7c4e4deaa0ed177a3c84f243a053b1f1

    • SSDEEP

      196608:zPmWNoOhqQiU27OokHplwAvpBenhmBveoeW1PrV8:z0eqXKHpllv7Kglq+Pa

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

    • Raccoon Stealer V2 payload

    • Raccoon family

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks